Here is the conversation (signatures stripped):
Waon Shinyoe Wrote:Hello Marcus,
I'm trying to upgrade my 34s with JTAG. But after I flashed it successfully, nothing happened to the calculator even if I pressed the reset key. I'm sure the system has been flashed into the flash memory, however the display just won't turn on. Please help me!
Marcus von Cube Wrote:Hi Waon,
I guess the SAM-BA boot bit is still clear so that the internal boot loader is active. When flashiig through JTAG (not the serial port with MySamba!) this bit is neither used nor affected and should be set to one to activate the flash instead of the boot rom.
Waon Shinyoe Wrote:Hello Marcus,
Thanks for the reply! That's also what I guess happened. But then how to set the boot bit through JTAG? Is it possible? And what's the address of that bit?
Marcus von Cube Wrote:Waon Shinyoe Wrote:And what's the address of that bit?
The easiest way to find out is to read the sources. 
From main.c:
Quote:/*
* Set the boot bit to ROM and turn off the device.
* Next power ON goes into SAM-BA mode.
*/
void sam_ba_boot(void)
{
/*
* Command the controller to clear GPNVM1
*/
lock();
flash_command( 0x5A00010C );
SUPC_Shutdown();
}
...
#define IAP_FUNC ((int (*)(unsigned int)) (*(int *)0x400008))
/*
* Issue a command to the flash controller. Must be done from ROM.
* Returns zero if OK or non zero on error.
*/
static int flash_command( unsigned int cmd )
{
SUPC_SetVoltageOutput( SUPC_VDD_180 );
return IAP_FUNC( cmd ) >> 1;
}
I must admit that this isn't too enlightening because it uses a secret ROM call to issue the command. So we have to resort to the manual:
Quote:8.1.4 SAM-BA Boot
The SAM-BA Boot is a default Boot Program which provides an easy way to program in-situ the
on-chip Flash memory.
The SAM-BA Boot Assistant supports serial communication via the DBGU.
The SAM-BA Boot provides an interface with SAM-BA Graphic User Interface (GUI).
The SAM-BA Boot resides in ROM and is mapped at address 0x0 when GPNVM bit 1 is set to 0.
To set a bit you'll need to send the command 0xB to the flash command register.
Quote:In order to perform one of these commands, the Flash Command Register (MC_FCR) has to be written with the correct command using the field FCMD. As soon as the MC_FCR register is written, the FRDY flag and the field FVALUE in the MC_FRR register are automatically cleared. Once the current command is achieved, then the FRDY flag is automatically set. ...
All the commands are protected by the same keyword, which has to be written in the 8 highest bits of the MC_FCR register.
Quote:19.3.3.5 GPNVM Bit
GPNVM bits do not interfere with the embedded Flash memory plane. Refer to the product definition
section for information on the GPNVM Bit Action.
The set GPNVM bit sequence is:
• Start the Set GPNVM Bit command (SGPB) by writing the Flash Command Register with the
SGPB command and the number of the GPNVM bit to be set.
• When the GPVNM bit is set, the bit FRDY in the Flash Programming Status Register
(MC_FSR) rises. If an interrupt was enabled by setting the bit FRDY in MC_FMR, the
interrupt line of the Memory Controller is activated.
• If the GPNVM bit number is greater than the total number of GPNVM bits, then the command
has no effect. The result of the SGPB command can be checked by running a GGPB (Get
GPNVM Bit) command.
One error can be detected in the MC_FSR register after a programming sequence:
• A Command Error: a bad keyword has been written in the MC_FCR register.
It is possible to clear GPNVM bits previously set. The clear GPNVM bit sequence is:
• Start the Clear GPNVM Bit command (CGPB) by writing the Flash Command Register with
CGPB and the number of the GPNVM bit to be cleared.
• When the clear completes, the bit FRDY in the Flash Programming Status Register
(MC_FSR) rises. If an interrupt has been enabled by setting the bit FRDY in MC_FMR, the
interrupt line of the Memory Controller is activated.
• If the GPNVM bit number is greater than the total number of GPNVM bits, then the command
has no effect.
One error can be detected in the MC_FSR register after a programming sequence:
• A Command Error: a bad keyword has been written in the MC_FCR register.
The status of GPNVM bits can be returned by the Enhanced Embedded Flash Controller
(EEFC). The sequence is:
• Start the Get GPNVM bit command by writing the Flash Command Register with GGPB. The
FARG field is meaningless.
• When the command completes, the bit FRDY in the Flash Programming Status Register
(MC_FSR) rises. If an interrupt has been enabled by setting the bit FRDY in MC_FMR, the
interrupt line of the Memory Controller is activated.
• GPNVM bits can be read by the software application in the MC_FRR register. The first word
read corresponds to the 32 first GPNVM bits, following reads provide the next 32 GPNVM
bits as long as it is meaningful. Extra reads to the MC_FRR register return 0.
For example, if the third bit of the first word read in the MC_FRR is set, then the third GPNVM bit
is active.
One error can be detected in the MC_FSR register after a programming sequence:
• a Command Error: a bad keyword has been written in the MC_FCR register.
Note: Access to the Flash in read is permitted when a set, clear or get GPNVM bit command is
performed.
Quote:19.4 Enhanced Embedded Flash Controller (EEFC) User Interface
The User Interface of the Enhanced Embedded Flash Controller (EEFC) is integrated within the Memory Controller with base address 0xFFFF FF60.
Registers are:
Offset Register Name Access Reset State
0x00 MC Flash Mode Register MC_FMR Read-write 0x0
0x04 MC Flash Command Register MC_FCR Write-only –
0x08 MC Flash Status Register MC_FSR Read-only 0x00000001
0x0C MC Flash Result Register MC_FRR Read-only 0x0
You can find the addresses of these bits in the ATMEL header files which are part of the source.
It boils down to the following:
The command to send is 0x5A00010B (0B for setting the bit, 0C for clearing).
The register to send the command to is at address 0xFFFFFF64.
Your JTAG command interface should allow to modify memory. Just send the command to the memory location and reboot.
Waon Shinyoe Wrote:Hello Marcus,
Wow thank you sooooo much!
Your explanation is so detailed! It makes me shame for the fact that I haven't read the code carefully and never read the manual of the ARM7 core...
And now I'm reading...
And here is an openOCD script which is part of the source tree. I use it from time to time to flash my JTAG equipped 20b if I need to debug on the hardware level. The calculator no longer responds to the serial port but access through JTAG is still possible:
Quote:# Program the flash for the wp34s project
# Binary image
set _IMAGE ../realbuild/calc.bin
# Configure adapter and device
source [find at91sam7l128.cfg]
# Terminate the configuration stage
init
targets $_TARGETNAME
reset init
halt
# Go slower for flash update
# jtag_khz 800
# CKGR_PLLR: 10.000 MHz
# mww 0xfffffc2c 0x0130bf01
# Info about flash banks (tends to hang the server)
#flash banks
#flash probe 0
#mww 0xffffff64 0x5a000000
#sleep 10
#mdw 0xffffff6c
#mdw 0xffffff6c
#mdw 0xffffff6c
#mdw 0xffffff6c
#mdw 0xffffff6c
#mdw 0xffffff6c
#mdw 0xffffff6c
#mdw 0xffffff6c
#mdw 0xffffff6c
#mdw 0xffffff6c
#mdw 0xffffff6c
# Erase the flash
# flash erase_address 0x00100000 0x20000
# Program the onchip flash
flash write_bank 0 $_IMAGE 0
# Set GPNVM bit 1 (boot from flash)
mww 0xffffff64 0x5a00010b
# Reset processor
reset
# Stop OpenOCD
shutdown
Search
Member List
Calendar
Help
